Daily.Entra.News
Aboutmerill.net
Microsoft Entra ID

Whats New Archive

24 June 2026Updated+136 / −0 lines

In brief

**Type:** New feature

What Entra admins need to know

Review the documentation change to determine whether it affects tenant configuration, security posture, or rollout plans.

This editorial summary was generated by AI from the documentation changes. Verify important details in the full Microsoft Learn article.

Documentation change

Open on Microsoft Learn ↗

The comparison below is an extract of the Microsoft Learn article showing only the changed content. Open the full article for complete context.

General Availability - Microsoft Entra Connect security hardening to prevent user account takeover

Type: Fixed
Service category: Entra Connect
Product capability: Access Control

When Microsoft Entra Connect adds new objects from Active Directory, the Microsoft Entra ID service tries to match the incoming object with an Entra object by looking up the incoming object’s sourceAnchor value against the OnPremisesImmutableId attribute of existing cloud managed objects in Microsoft Entra ID. If there's a match, Microsoft Entra Connect Sync takes over the source or authority (SoA) of that object and updates it with the properties of the incoming Active Directory object in what is known as "hard-match."

As part of ongoing security hardening, Microsoft is going to introduce enforcement changes in Microsoft Entra Connect to mitigate the risk of account takeover via hard match abuse. Enforcement of this change will begin on July 1, 2026.

What’s Changing:

  • Microsoft Entra will block attempts by Entra Connect to modify the OnPremisesObjectIdentifier attribute after it has already been mapped to a synced user object. This prevents re‑mapping an existing Entra ID user to a different on‑premises identity.
  • Audit logs have been enhanced to capture changes to OnPremisesObjectIdentifier and DirSyncEnabled, enabling better visibility into synchronization behavior.
  • To support legitimate scenarios where an existing synced Entra object must be remapped to another on-premises object, Microsoft has introduced a Microsoft Graph API that allows controlled recovery actions, without re‑enabling hard‑match abuse or unauthorized re‑mapping.
  • Resetting a user’s OnPremisesObjectIdentifier field will not impact subsequent sync jobs. This means that both the cloud sync and connect sync clients can continue syncing the user object that was reset without issue. Each time a user object is synced after that field has been set to null, it gets assigned a new GUID.

What's Not Changing:

  • This enforcement applies only to scenarios where OnPremisesObjectIdentifier is being modified for synced object since it was remapped to different on-premises object (through hard-match). Hard match and take over of cloud objects using onPremisesImmutableId remains supported and unchanged.

Customer Action Required:

  • Review and implement updated hardening guidance, including recommended flags to disable hard match takeover where appropriate.
  • Identify potentially impacted users by reviewing audit logs for recent changes to OnPremisesObjectIdentifier. Refer to the Microsoft Entra Connect Sync error code for impacted users
  • Test the new Graph API-based recovery flow to ensure readiness before enforcement begins on July 1, 2026.

Microsoft Graph API for Recovery

Starting July 1st, 2026, the sync operations that attempt to remap existing synced objects in Entra to a different on-premises object will fail with the following error:

“Hard match operation blocked due to security hardening. Review OnPremisesObjectIdentifier mapping.”

Customers can recover by first clearing the OnPremisesObjectIdentifier property on the Entra object and then re-attempting the hard-match and takeover operation.

To clear the OnPremisesObjectIdentifier for a user, use the following Microsoft Graph API call:

PATCH https://graph.microsoft.com/beta/users/{userId}

Body:

{
onPremisesObjectIdentifier: null
}

Required permissions:

  • Delegated or application permission: “User-OnPremisesSyncBehavior.ReadWrite.All”
  • The caller must also have one of the following roles: Global Administrator or Hybrid Identity Administrator
  • Any user, including global or hybrid admins, cannot reset the field via MS graph if the app isn’t granted User-OnPremisesSyncBehavior.ReadWrite.All

Additional Guidance:

  • If enforcement blocks an operation, the following error message will be returned: “Hard match operation blocked due to security hardening. Review OnPremisesObjectIdentifier mapping.”
  • Use audit logs to identify affected objects. Look for “Update user” events where OnPremisesObjectIdentifier was modified. These users may require remediation before enforcement begins.

The Microsoft Entra Connect Sync .msi installation file is exclusively available on Microsoft Entra admin center underMicrosoft Entra Connect. Check our version history page for more details on available versions.

Public Preview - Just-in-time password migration to Microsoft Entra External ID

Type: New feature
Service category: B2C - Consumer Identity Management
Product capability: B2B/B2C

The Just-in-Time (JIT) Password Migration feature is designed to provide a seamless and secure experience for customers transitioning to Microsoft Entra External ID. This capability enables external identity providers to migrate user credentials during sign-in, eliminating the need for bulk password resets and minimizing disruption for end users. When a user meets the migration conditions at sign-in, their credentials are securely transferred as part of the process, ensuring continuity and reducing friction.

By integrating migration into the authentication flow, organizations can simplify administrative tasks while maintaining security standards. This approach not only enhances user experience but also accelerates adoption of Microsoft Entra External ID without compromising operational efficiency.

Public preview - Protect enterprise generative AI applications with Prompt Shield

Type: New feature
Service category: Internet Access
Product capability: Network Access

Block prompt injection attacks to enterprise GenAI apps in real-time with universal policy controls, extending Azure AI Prompt Shield to all network traffic. For more information, see: Protect enterprise generative AI apps with prompt injection protection (preview).

Public Preview - B2B guest access support in Global Secure Access

Type: New feature
Service category: B2B
Product capability: Network Access

You can now enable the B2B guest access feature for your guest users with the Global Secure Access client, signed in to their home organization's Microsoft Entra ID account. The Global Secure Access client automatically discovers partner tenants where the user is a guest and offers the option to switch into the customer's tenant context. The client routes only private traffic through the customer's Global Secure Access service. For more information, see: Learn about Global Secure Access External User Access (Preview).

Public Preview - Data exploration using Microsoft Security Copilot in Entra

Type: New feature
Service category: N/A
Product capability: Identity Security & Protection

Microsoft Security Copilot in Microsoft Entra now supports data exploration when prompts return datasets with more than 10 items. This feature is in preview and available for select Microsoft Entra scenarios. From the Copilot chat response, select Open list to access a comprehensive data grid. This allows you to explore large datasets with complete and accurate results, enabling more efficient decision-making. Each data grid displays the underlying Microsoft Graph URL, helping you verify query accuracy and build confidence in the results. For more information, see: Microsoft Security Copilot scenarios in Microsoft Entra overview.

November 2025

Public Preview - Microsoft Entra ID Account Recovery